Scott, one thing you can do is create a "reverse-spam-check" if that makes sense! If you know a particular domain is trusted, and yet continues to fail SPF, you can add a custom spam check that adds a weight of -99 when the return-path includes the trusted domain name. This should override any spam association with that message. Please be sure to set it up on the return-path rather than the from header though, otherwise this could be compromised to send your users spam. I hope this helps!
Kyle Kerst
IT Coordinator
SmarterTools Inc.
www.smartertools.com